Week 44 of 2026

The Watchtower from 26 Oct to 1 Nov 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works

Week 43 of 2026 · All weeks · Atom feed

Attack-shaped requests: 321,450+51,976 (+19%) on the week before
Addresses: 4,403−2,293 (−34%) on the week before
Networks: 899
Sites reached: 40+4 (+11%) on the week before
Newly blocked: 1,915−1,097 (−36%) on the week before
Busiest hour (UTC): 29 Oct 02:0017,971 requests

In short

In the week of 26 Oct to 1 Nov 2026 the sensors recorded 321,450 attack-shaped requests from 4,403 addresses on 899 networks.

They reached 40 sites.

The busiest day was Tuesday 27 Oct with 65,162 requests; the quietest, Saturday 31 Oct, had 27,662.

The busiest single hour began at 29 Oct 2026 02:00 UTC: 17,971 requests.

By kind: hunting for secrets 50%, scanning 22%, password guessing 15%.

The single most common request shape, 132,964 times: an address requested a .env file, hoping to find API keys or database credentials.

By sensor: web 37%, edge 33%, honeypot 30%, the rest under 1%.

The busiest network was AS396982 (Google LLC, cloud): 155,535 requests from 473 addresses, 421 of them blocked now.

1,915 addresses were newly blocked on our servers: 904 on home broadband networks, 669 on cloud networks, 309 on hosting networks, 21 on mobile networks, 12 on internet provider networks. 1,915 of them stay on the list with no end date.

Against the week before: requests 269,474 to 321,450 (+19%), addresses 6,696 to 4,403 (-34%), new blocks 3,012 to 1,915 (-36%).

Commentary

In the week of 26 Oct to 1 Nov 2026 the sensors recorded 321,450 requests from 4,403 addresses on 899 networks. They reached 40 sites. Requests rose from 269,474 the week before, up 19%, while the number of addresses fell from 6,696 to 4,403, down 34%.

Tuesday 27 Oct was the busiest day with 65,162 requests. Saturday 31 Oct was the quietest with 27,662. The busiest single hour began at 2026-10-29T02:00:00Z and held 17,971 requests. Hunting for secrets made up 50% of the traffic, and a request for a .env file was the most common single shape, 132,964 times. The busiest network was AS396982, the network of Google LLC, a cloud network: 155,535 requests from 473 addresses, with 421 of them blocked now. We newly blocked 1,915 addresses, down from 3,012 the week before. 904 were on home broadband networks, 669 on cloud networks and 309 on hosting networks. All 1,915 stay on the list with no end date.

By day

Attack-shaped requests per day, 26 Oct to 1 Nov 2026 (UTC)
Day	Requests	Share
Monday 26 Oct	60,490
Tuesday 27 Oct	65,162
Wednesday 28 Oct	46,756
Thursday 29 Oct	39,065
Friday 30 Oct	35,202
Saturday 31 Oct	27,662
Sunday 1 Nov	47,113

What they tried

By kind

Attack-shaped requests by attack type
Attack type	Requests	Share
hunting for secrets	161,689
scanning	71,189
password guessing	48,071
injection	13,878
known exploits	8,345
password spraying	7,326
unclassified	6,676
scanning tools	2,945
leaked-password reuse	935
mail relay probing	217
fake crawlers	173
open proxy probing	6

By sensor

Attack-shaped requests by sensor
Sensor	Requests	Share
web	118,103
edge	105,919
honeypot	95,694
mail	1,304
named	338
ssh	92

Most common request shapes

The ten most common request shapes
Kind of request	Attack type	Requests
Requested a .env file, hoping to find API keys or database credentials	hunting for secrets	132,964
Typed a command into a decoy shell that is not connected to anything real	scanning	41,583
Tried a username and password on a decoy remote login that never lets anyone in	password guessing	41,191
Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root	injection	13,406
Requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot	hunting for secrets	8,721
Triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt	known exploits	7,904
Requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods	password spraying	7,292
Was blocked at the edge without matching any specific attack signature	unclassified	6,480
Fuzzed a short, random filename looking for a forgotten script that responds	scanning	5,394
Requested a decoy path that only a scanner would ask for	scanning	4,686

Busiest networks

The ten networks with the most attack-shaped requests
Network	Organisation	Type	Addresses	Blocked now	Requests
AS396982	Google LLC	cloud	473	421	155,535
AS198364	Banatsync Srl	home broadband	31	31	41,968
AS48090	Techoff Srv Limited	hosting	61	61	23,677
AS47890	Unmanaged Ltd	home broadband	28	27	23,347
AS211590	Bucklog SARL	hosting	6	6	22,673
AS218785	Tc Datacenter Limited	hosting	37	37	3,975
AS40021	Contabo Inc.	hosting	3	3	3,244
AS6878	T-Systems International GmbH	home broadband	1	1	3,163
AS14061	DigitalOcean, LLC	hosting	320	192	2,602
AS31898	Oracle Corporation	cloud	94	86	2,584

Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.

Block list

New blocks by network type

Addresses newly blocked that week, by network type
Network type	Addresses	Share
home broadband	904
cloud	669
hosting	309
mobile network	21
internet provider	12

How they got there

New blocks: 1,915
No end date: 1,915every block

Against the week before

This week against Week 43 of 2026
Measure	Week 43 of 2026	Week 44 of 2026	Change
Attack-shaped requests	269,474	321,450	+51,976 (+19%)
Addresses	6,696	4,403	−2,293 (−34%)
Sites reached	36	40	+4 (+11%)
Newly blocked	3,012	1,915	−1,097 (−36%)

Week 43 of 2026 in full